TXTBOOK Campaign Targets T-Bank With 993 Malicious npm Packages and a Sliver Implant

Article Details

Attack Vectors

• Dependency confusion through public npm packages that reproduce T-Bank's private package names. CloudSEK identified 993 packages, but reported no evidence that a target build successfully resolved or executed them.
• The earlier PyPI delivery installs a path-configuration file that executes at interpreter startup. npm variants execute through an appended entry-point call on import or, in some version bands, a postinstall hook.
• The loader reconstructs a native executable from several hundred sequentially numbered DNS TXT records rather than downloading a binary over HTTP.
• The second-stage loader checks whether victim infrastructure resolves before contacting attacker infrastructure, restricting execution to an environment consistent with the target's internal network.
• The delivered Sliver implant provides extensive remote-access and post-exploitation capabilities, with encrypted HTTPS beacons routed through Cloudflare Workers.
• Later package versions vary payloads and loader filenames per package and assemble infrastructure names from string fragments, reducing the effectiveness of hash and whole-hostname matching.

Defensive Notes

• Enforce registry scoping so private package names cannot fall through to public registries; package blocklists alone do not address dependency confusion.
• Compare the reported malicious package inventory with internal packages and lockfiles. The article recommends treating a listed package in a lockfile as a compromise and rotating credentials available to the affected build environment.
• Block identified attacker staging and C2 infrastructure, and hunt for sequentially numbered DNS TXT lookups that reconstruct executable content. The supplied content does not expose the staging or C2 hostname lists.
• Do not block or sinkhole the loader's target-gate hostnames: the article explicitly identifies them as victim infrastructure.
• Detect package entry points requiring randomized underscore-prefixed modules inside swallowed try/catch blocks, and inspect runtime hostname assembly from array fragments.
• Use recovered minisign server keys and transport encoder fingerprints to cluster samples across infrastructure changes.
• Review public code, configuration, and documentation for disclosures of private package and service names; reserve publicly inferable internal package names where appropriate.
• Flag npm publishing accounts with twelve-character lowercase alphanumeric usernames and identical mailbox local parts at web-library.net.
• Account for analysis limitations: the Windows loader reflectively maps a still-packed payload without decompression, producing a failed load that can obscure the implant's capabilities.
• The article reports that Linux implants retain cryptographic keys in plaintext, enabling offline decryption of captured server-to-implant traffic for those builds.